From b3de21315720037c2cf1a1e6166326fc10a54b80 Mon Sep 17 00:00:00 2001 From: Dominique RIGHETTO Date: Mon, 24 Aug 2026 19:48:00 +0200 Subject: [PATCH 1/2] Enhance stack trace detection for generic exceptions Added detection for generic exceptions in responses. --- other/stackTrace.bcheck | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/other/stackTrace.bcheck b/other/stackTrace.bcheck index 90bb852..2f69b03 100644 --- a/other/stackTrace.bcheck +++ b/other/stackTrace.bcheck @@ -5,12 +5,15 @@ metadata: author: "Dominique Righetto" tags: "passive","informative" +# Sources: +# https://github.com/PortSwigger/error-message-checks/blob/master/src/main/resources/burp/match-rules.tab +# https://github.com/righettod/burp-piper-custom-scripts/blob/main/detect-response-with-errors-disclosure.py + define: common_detail = "The response contains a stack trace that discloses information about the server-side technology used: " common_remediation = "Add an error handler to ensure any errors that may occur are caught, then return a generic message." given response then - # Source: https://github.com/righettod/burp-piper-custom-scripts/blob/main/detect-response-with-errors-disclosure.py # Java if {latest.response.body} matches "(java\.[\w]+\.[\w]+)" then report issue: @@ -20,7 +23,7 @@ given response then remediation: `{common_remediation}` end if # .Net - if {latest.response.body} matches "(\w+Exception:\s['\"\w\d\s]+)" then + if {latest.response.body} matches "Microsoft\.([a-zA-Z0-9\.]+)Exception" then report issue: severity: info confidence: firm @@ -51,3 +54,11 @@ given response then detail: `{common_detail} Ruby.` remediation: `{common_remediation}` end if + # Generic + if {latest.response.body} matches "(\w+Exception:\s['\"\w\d\s]+)" then + report issue: + severity: info + confidence: firm + detail: `{common_detail} Generic exception catched so the technology cannot be clearly determined.` + remediation: `{common_remediation}` + end if From abebb5d1b6bab440d6cb8d049b4fab6ea2ed2158 Mon Sep 17 00:00:00 2001 From: Dominique RIGHETTO Date: Tue, 25 Aug 2026 06:34:26 +0200 Subject: [PATCH 2/2] Refine exception matching conditions in stackTrace.bcheck --- other/stackTrace.bcheck | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/other/stackTrace.bcheck b/other/stackTrace.bcheck index 2f69b03..53c20f9 100644 --- a/other/stackTrace.bcheck +++ b/other/stackTrace.bcheck @@ -15,7 +15,7 @@ define: given response then # Java - if {latest.response.body} matches "(java\.[\w]+\.[\w]+)" then + if {latest.response.body} matches "(java|javax|jakarta)\.([a-zA-Z0-9\.]+)Exception" then report issue: severity: info confidence: firm @@ -23,7 +23,7 @@ given response then remediation: `{common_remediation}` end if # .Net - if {latest.response.body} matches "Microsoft\.([a-zA-Z0-9\.]+)Exception" then + if {latest.response.body} matches "(Microsoft|System)\.([a-zA-Z0-9\.]+)Exception" then report issue: severity: info confidence: firm